merge fixes
signup/remove through API without auth