Restrict API to just the logged in user