- set permissions to 'isAuthenticated' instead of 'AllowAny'