Add Token protection to API Controllers

[StuartFerguson]

Currently the controllers are not marked with the Authorise attribite this needs to be resolved asap and the UI calls updated accordingly as they are currently passing a null access token