allow some methods when not logged in