the API seems to cut in first - without this change, I had to specify a user on my test curls before I could get access to the route. I'll test again tomorrow and provide some sample output with and without.