Finished the api controller, but access is restricted at the controller
level.  So have to change this to a module to method level
restrictions.  Also have the issue of temporary access.