I think we might need to put some checks somewhere in the controller around whether this is a user or a visitor and whether they are allowed access to the API. 
can't have people scraping hidden motions