fixed security hole

if using cache, there's no authentication test, and this API is open to the unauthorized user until the cache is invalidated.
Merge pull request #2 from bennynis/master

fixed security hole