Move the authorize method to api_controller