authentification needed to access any url (except api)