only authenticate for API requests and not documentation requests