adding login warning to most api calls, but not all #89