don't always require authorization