splitting up authorization check in api, extra file for api errors