Use limited options JSON reply when unauthenticated