better php API authorization