allow non updating routes to be accessed with out auth