allow for Public (no auth) service calls