`api/collection/[id]` currently has PUT and DELETE, which are withAuth APIs `api/collection-by-id/[id]` is a GET API and does not require auth Need a better way to combine auth / non-auth requests in a single apiWrapper (`auth` boolean in `ReqExpected`?)