#6 Making sure API endpoints are only executed when logged in