some routes dont need authorization