removed authenticate from api_controller