user registration should not required authentication