removing authentication from permalinks - not sure though if it's the right approach