dont check auth token on api controllers