api can authenticate using email and password in the querystring