secure web api with identity model
add auth code - not yet all implemented
feature parity with old API