move mutating endpoints to the authenticated api