in the middle of adding web api authentication