api access only for authenticated users
api/users should be read only