changed permissions for Api to IsAuthenticated