Add authentication for API routes