do not require auth for any endpoints.  circle back and enforce this later