Add authentication to APIs.

We need to:
- [ ] add permissions
- [ ] add login URLs