limit unauthenticated users to read_only actions on posts