add [Authorize] to protect API