don't require password for homepage