turned off ensureAuth for GET/POST /players/create