added api authentication... that actually works.. :)
/api/login 
/api/logout