make authenticated requests as the logged in user