allow public resources, don't promp for authentication