Don't require auth header for GET.