skip auth for things requested via javascript