add an authenticated route
add an extra unauthenticated route
update instructions in readme