PHP/NodeJS solution for limiting access to API functions