add organizational filtering to api, closes #4