remove auth from DashboardApi to AuthFilter