Added access control to backend API calls