Auth header not required on account validate