add publicPaths option to let some paths through without authentication
Merge branch 'master' into excluded-paths