1st shot at auth on the api side