wrap  for authenticated requests to pocument API; tweak route access levels