api: inbox minor changes. dropped need of 'view' and 'upload' keywords. use method and auth to determine actions