don't require authorization to access static resources