do not authenticate for static resources