hey, we do not want the API to be exposed without login, do we?