allow NoAuthenticate annotation on Type and Constructor