moved api auth validation back to its own method, codeclimate counts as dup :/