Protect family api behind auth