api tweaks in support of auth