#10 Authenticate every request except session requests