api: log post route excluded from app lock middleware