ActionFinish in the API

Last mile of the ActionFinish function to the API
re online discussion: we can use a different auth func that accepts unit tags, and does all the checking internally -- it's absolutely an auth concern