do not require authorization for stuff without controllers
add open permissions until we figured out the more specific handling
add auth statement in server loader