Client-side app, api request authorization