Don't require auth on login and logout pages, to avoid redirect loop