Full authentication rework, with unauthenticated access