allowing only authenticated or authenticating requests