Fix authorization in API routes