Moving API auth check to base controller