- added authorisation to all APIs in the backend