             @sendSuccess(res, cleandocs)
 
   getMembersAPI: (req, res, courseInstanceID) ->
+    return @sendUnauthorizedError(res) if not req.user?
     CourseInstance.findById courseInstanceID, (err, courseInstance) =>
       return @sendDatabaseError(res, err) if err
       return @sendNotFoundError(res) unless courseInstance

                @sendSuccess(res, @formatEntity(req, courseInstance))

  removeMember: (req, res, courseInstanceID) ->
    userID = req.body.userID
    return @sendBadInputError(res, 'Input must be a MongoDB ID') unless utils.isID(userID)
    CourseInstance.findById courseInstanceID, (err, courseInstance) =>

            @sendSuccess(res, @formatEntity(req, courseInstance))

  post: (req, res) ->
    return @sendUnauthorizedError(res) if not req.user?
    return @sendBadInputError(res, 'No classroomID') unless req.body.classroomID
    return @sendBadInputError(res, 'No courseID') unless req.body.courseID
    Classroom.findById req.body.classroomID, (err, classroom) =>
