Authenticate all but get requests