bearer authentication added to API/Service layer