add api.php
security!
db stuff
json!