add authentification for api
api is back to public