generate route un-authed, open to the public