moved api auth back into main validation method