add api routes with basic authentication