we need to allow sessions to be accessed without auth.