The API needs to have user restrictions

If logged in, any user can do anything. We need to have a user that can only download data