added authentication rule to allow any user to submit the hepaddform