droom api purely local: no auth token header