handle unauthenticated requests
* need to pull out json parsing into its own script, if possible