frontend -> calls

/api/something

-> calls our backeend method (has a check session because it has a behavior if the user is a guest) -> calls external api