shift api to local-request protection, no authn
log less