Authenticating URL purge requests via API