skip authentication in APIController