app handles auth required api #SH-6 comment