make api a little more secure