added more api functionality and untested login authentication: seems weak