extend authentication to api