fix(auth) allow authentication request without credentials