Open/unrestricted subset of API

Do you need custom middleware? Because if you don’t then you can set the insecure paths to be ignored and they will bypath auth altogether?