allow readonly without token in url