make sure to allowUnauthenticatedUser