service-resource level auth instead of url level auth
In current impl - Any user can access get methods, only supervisors can access create, update service methods