add Authorize attribute to PostProduct method