added authorization filter to enforce API authentication