/api/doc/ allowed for everyone