Authorization for API.

Only admins can Delete/Update.