The method can only claim prizes on behalf of the currently logged in user (current_user).  If not logged in, it forces you to sign in:

try /prize_providers/1/claim_prize

This "can" after the "cannot" allows this one method (claim_prize) to work for non-admins, while the other RESTful CRUD APIs only work for admins.