Allow abilities that require no login for token based access