limits API access to signed in users.