api,server: slice are already refs, no need to return ptr