chore: ignore jwt if not access controlled

Author: tripodsan

src/steps/authenticate.js

@@ -36,11 +36,9 @@ export function isAllowed(email = '', allows = []) {
  * @returns {Promise<void>}
  */
 export async function authenticate(state, req, res) {
-  // get auth info
-  const authInfo = await getAuthInfo(state, req);
-
   // check if `.auth` route to validate and exchange token
   if (state.info.path === '/.auth') {
+    const authInfo = await getAuthInfo(state, req);
     await authInfo.exchangeToken(state, req, res);
     return;
   }
@@ -50,6 +48,9 @@ export async function authenticate(state, req, res) {
     return;
   }
 
+  // get auth info
+  const authInfo = await getAuthInfo(state, req);
+
   // if not authenticated, redirect to login screen
   if (!authInfo.authenticated) {
     // send 401 for plain requests