allow access to json page without auth