updated api to only allow get from authed users. added api tests -- closes #24