support non-authenticated public access