Only perform auth checks on HTTP requests