user and public actions may not require auth