redirect non-authenticated request to the public root