allow anonymous user access course api