diff --git a/smash/smash/urls.py b/smash/smash/urls.py
index 53e2f4c545076cfd592f3f9abdf25ce423b72406..e2a8cc8f902b3a586d0b958bbb56e116b4b1a799 100644
--- a/smash/smash/urls.py
+++ b/smash/smash/urls.py
@@ -20,8 +20,10 @@ from django.conf import settings
 from django.conf.urls.static import static
 
 import web.urls
+import web.api_urls
 
 urlpatterns = [
     url(r'^admin/', admin.site.urls),
-    url(r'', include(web.urls))
+    url(r'', include(web.urls)),
+    url(r'^api/', include(web.api_urls))
 ] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
diff --git a/todos.txt b/todos.txt
index e7d8c80581e17d557c7e4a86c5311fe06638a85a..a26952d53f65335485016e89e8deec8cd8316ec5 100644
--- a/todos.txt
+++ b/todos.txt
@@ -5,6 +5,8 @@
  - implement `on leave` button
  - what about possible sunday in availabilities?
  - make some names sound/look more pythonic
+ - in beta remember to disable Guest Access
+ - in beta remember to forbid not-logged users to browse the API
 
 ** Visual
  - None