Exempt /public/* urls from auth