require no authentication in session new and create actions