Added authorization to User and ApiMethod