secure REST calls sot that only staff can use it. was too risky otherwise