allow anonymous users (users without auth header)
bugfix