testing to serve without authentification only by key