remove exempt path stuff and don't 401 when no token