added authorize attribute to api controller