App has a parent api controller for restricting login access