Add auth-mode API; re-organize all WS provided endpoints into /api