thanks should be exempted from authenticate