This tutorial is incomplete and buggy #5 - allow access to pubic urls also for authenticated user