api secure authentication works well. Missing tests for this, next step...of course