make the distinction clearer between /api/org and /api/orgs and that basic auth must be used for the /api/orgs resource
