removed auth from stats route