add authentication checks in api controllers