debug on
turn debug off
don't require auth for /api route