more children works for logged in users

using bypassAuth - once OAuth is supported for morechildren.json we should use auth details with the call