set req._isServer=true for API calls, use that as access check