authenticate until required

no need to authenticate for all rpc's