protect api- require login