fixed auth levels for api