perform API auth before configured User class may require login

This allows usage of AccessControl filter in API