you can and you shouldn't have to authenticate