I'm not sure if we want /rss to bypass authentication, do we?
One might argue that we already bypass authentication for http static web serving, but we should change that sooner or later. Besides, static serving looks less dangerous than rss.