sign should be authenticated!

At some point, I need to make a generic method for allowing all
endpoints to called via authenticated or non auth methods.