api moved to /api, validation improved for ajax ui