first POST request and fix security configuration for API