make API authentication & authorization explicit