stats endpoints should not be protected