404/403 do not require auth.