allow non basic auth paths to get set first