fix onBeforeAction to allow non authed http routes
Merge branch 'master' of https://github.com/marcn/pandaslist