Why do we need the distinction between authenticated and non-authenticated in this path?  Seems sensible enough to me to just let everyone have the 'good' behavior for mumble:// URLs.