app needs authorization scheme
public controllers to serve data visible to all