added vulnerable auth check for the API