fixes php fatal error when non-logged-in users visit API page, and adds ...

...security for all application pages