make every api protected by user authentication