make sure only users can use alerts api and see link, controller needs still to be checked