move api into frontend; token based api call; add user notices api