add read-only flag, add ability to skip auth
add support for ranged flow requests