handle requests with no auth headers