I know from client side you dont have to provide authentication in the header, but was hoping you didnt have to provide auth for server side