Require auth for read-only requests too