fixed api, added internal security token on api