Allow the login screen even without credentials;
All other OAuth endpoints need credentials or they return forbidden