relax all api auth for testing purposes
test comment added to app.js