reject settings requests if not authenticated