add secure token authentication to api root file