require authentication only on "write" actions