allow api access even user is disabled
block api access from other than trusted ip