Enabled the API to use the currently logged-in users permissions against...

... api endpoints
but why would it log passwords? Oh because passwords are sent to the API to log people in for external things...