removed requireAuth middleware