allow uncofirmed access so public website does not kick you out