Our API supports HTTP basic auth, which can happen in a GET request. That will bypass this middleware entirely.