Use token authentication for API requests.

pages/api/website/[id]/active.js

@@ -1,12 +1,18 @@
 import { getActiveVisitors } from 'lib/queries';
-import { methodNotAllowed, ok } from 'lib/response';
+import { methodNotAllowed, ok, unauthorized } from 'lib/response';
+import { allowQuery } from 'lib/auth';
 
 export default async (req, res) => {
   if (req.method === 'GET') {
-    const { id } = req.query;
-    const website_id = +id;
+    if (!(await allowQuery(req))) {
+      return unauthorized(res);
+    }
 
-    const result = await getActiveVisitors(website_id);
+    const { id } = req.query;
+
+    const websiteId = +id;
+
+    const result = await getActiveVisitors(websiteId);
 
     return ok(res, result);
   }