Api controller now supports secured and unsecured actions (secret vs. master secret)