apply patch from TomH for #477 and dont require http auth on GET to the API.