change to "pass" since we may want to get data from an unauthenticated endpoint