Authentication for web api methods now working. relaxing username/pw policies since this is a demo