making /api/users and /api/challenges public