Improve authorisation logic to Profile APIs

Add superuser authorisation