bad karma stuff, "people is sad" :(
added API authentication via session instantiation requests (token auth.); new vers. 4.00.213; TODO: must re-enable "public" controllers routing