#66: add the web api (no security)
added authorization