work unprotected resource. e.g. .well-knwon/openid-configuration