whitelisting non auth actions