move unauthenticated api endpoints into separate feature