api authentication
omniauth authentication