unprotect /api/challenge/<slug>