Server-side authorisation rules

Making sure the API is scoped to the current user