secure api, set username from current user when creating point