adding authentication to api