dont authentication asset paths (assetpack needs to emulate GETs), closes #112