set [Authorize] on Get fn