- authentication will not check every time but simple catch an authenticated request
- api communication is separated from view definitions