first working API with django auth