added non secure getuser api route