public access for all content per request, TODO restrict sensitive fields