web api (with security), database fixes, domain classes