I can't even get unauthenticated requests to work