only apply auth to GET requests