catch empty var PUTs
moved authetifiated requests to /api/