These were included in application controller as a defensive measure to ensure that all controllers required authentication by default.  Not requiring authentication in a controller for this app should be an explicit thing IMO.