make unauthenticated access to media resources configurable