no FallbackPolicy: an endpoint without [Authorize] is public
