took auth off GET endpoints