Moved capability entirely into API, added basic auth to capability, start_call route.