#grant all access to /api # restrict access to /api/patrons to localhost only require all granted require local