Add authentication to APIs.

We need to:
- [x] add permissions
- [x] add login URLs