allow api for restricted by global password sites