changed the route for tag api and limited it to authenticated users only