update api to allow tagging by unauthenticated users