allow options through without auth