Enabled the API to use the currently logged-in users permissions against...

... api endpoints
yeah just check, it is overridden (all url setting are)