secure all api calls