initial work on api authentication