views now follow the new auth rules
moving everything to API
moving everything to API