don't block "public" messages with authenticated scope