add authorization to API, closes #95