add checks to allow requests without authorization