api controller should inherit direct from ActionController::Base (different auth mechanism)