remove username and apikey from API requests - move to being header
params for auth instead