FIX: api now requires logging in