secured a few of the controller actions for authenticated users only. added some API docs to the readme.