Authentication filter just for api requests