Authenticate API controllers with token