don't block "public" messages with authenticated scope

Not sure this is the only place, but I hope so.