stats endpoints should not be protected
Merge remote-tracking branch 'upstream/master'