controller test
test unauthenticated endpoint