web router has things like sessions etc added onto it. Api router is minimal, doesn't include things like csrf