disable protection in assets controller else cookies/session breaks in apache deployment