add tests for all internal apis to verify that they are not publically accessible via the router