Add access controls to APIs

[dqnykamp]

This PR adds checks to make sure that the logged in user has permission to access or modify the content.

Builds off #2418.