refactor of the api security including the anonymous user check