No auth for getting assets & Don't croak on GET without apikeys

now as two separate commits