allow unauthenticated previews