some magic api.php, includes access level check and header response fix and now function can return err code