authentication checks when modifying api user requests