Move API out of api subdomain
API token based authentication