allow posts.json to unauthed and show published posts