[CHORE] fix routes and don't keep post user behind auth