Refactor Test Before Changing Behavior
Make requires_authentication? Be Smart

Based on the action and the whitelist, be smarter about whether to
require authentication.