add a SUPER SECRET (!!!) api endpoint we will never tell you about (EVAR!!)