don't force auth for thumbnail and public assets