limit API usage unless security token specified
much progress on pools