by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.