Set authentication head of POST /users to optional