move authorization into each Api endpoint function.