Opened up API to AllowAny on root