allow anon access to the signout url/action