diff --git a/package-lock.json b/package-lock.json
index 2478eae..7358fc1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -749,7 +749,7 @@
                 "json-fallback": "0.0.1",
                 "jsonp": "~0.0.4",
                 "packageify": "^0.2.0",
-                "qs": "git://github.com/jfromaniello/node-querystring.git#5d96513991635e3e22d7aa54a8584d6ce97cace8",
+                "qs": "qs@git://github.com/jfromaniello/node-querystring.git#5d96513991635e3e22d7aa54a8584d6ce97cace8",
                 "reqwest": "^1.1.4",
                 "trim": "~0.0.1",
                 "winchan": "^0.1.1",
@@ -6173,7 +6173,8 @@
                 "ansi-regex": {
                     "version": "2.1.1",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "aproba": {
                     "version": "1.2.0",
@@ -6194,12 +6195,14 @@
                 "balanced-match": {
                     "version": "1.0.0",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "brace-expansion": {
                     "version": "1.1.11",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "balanced-match": "^1.0.0",
                         "concat-map": "0.0.1"
@@ -6214,17 +6217,20 @@
                 "code-point-at": {
                     "version": "1.1.0",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "concat-map": {
                     "version": "0.0.1",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "console-control-strings": {
                     "version": "1.1.0",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "core-util-is": {
                     "version": "1.0.2",
@@ -6341,7 +6347,8 @@
                 "inherits": {
                     "version": "2.0.3",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "ini": {
                     "version": "1.3.5",
@@ -6353,6 +6360,7 @@
                     "version": "1.0.0",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "number-is-nan": "^1.0.0"
                     }
@@ -6367,6 +6375,7 @@
                     "version": "3.0.4",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "brace-expansion": "^1.1.7"
                     }
@@ -6374,12 +6383,14 @@
                 "minimist": {
                     "version": "0.0.8",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "minipass": {
                     "version": "2.2.4",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "safe-buffer": "^5.1.1",
                         "yallist": "^3.0.0"
@@ -6398,6 +6409,7 @@
                     "version": "0.5.1",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "minimist": "0.0.8"
                     }
@@ -6485,7 +6497,8 @@
                 "number-is-nan": {
                     "version": "1.0.1",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "object-assign": {
                     "version": "4.1.1",
@@ -6497,6 +6510,7 @@
                     "version": "1.4.0",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "wrappy": "1"
                     }
@@ -6582,7 +6596,8 @@
                 "safe-buffer": {
                     "version": "5.1.1",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "safer-buffer": {
                     "version": "2.1.2",
@@ -6618,6 +6633,7 @@
                     "version": "1.0.2",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "code-point-at": "^1.0.0",
                         "is-fullwidth-code-point": "^1.0.0",
@@ -6637,6 +6653,7 @@
                     "version": "3.0.1",
                     "bundled": true,
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "ansi-regex": "^2.0.0"
                     }
@@ -6680,12 +6697,14 @@
                 "wrappy": {
                     "version": "1.0.2",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "yallist": {
                     "version": "3.0.2",
                     "bundled": true,
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 }
             }
         },
@@ -8235,6 +8254,7 @@
                     "resolved": "https://registry.npmjs.org/boom/-/boom-0.4.2.tgz",
                     "integrity": "sha1-emNune1O/O+xnO9JR6PGffrukRs=",
                     "dev": true,
+                    "optional": true,
                     "requires": {
                         "hoek": "0.9.x"
                     }
@@ -8335,7 +8355,8 @@
                     "version": "0.9.1",
                     "resolved": "https://registry.npmjs.org/hoek/-/hoek-0.9.1.tgz",
                     "integrity": "sha1-PTIkYrrfB3Fup+uFuviAec3c5QU=",
-                    "dev": true
+                    "dev": true,
+                    "optional": true
                 },
                 "http-signature": {
                     "version": "0.10.1",
diff --git a/src/app.js b/src/app.js
index 74c48f1..974b88e 100644
--- a/src/app.js
+++ b/src/app.js
@@ -40,18 +40,20 @@ _.forEach(routes, (verbs, path) => {
       throw new Error(`${def.method} is undefined`);
     }
     const actions = [];
-    actions.push((req, res, next) => {
-      const v3jwt = _.get(req.cookies, constants.JWT_V3_NAME);
-      if (v3jwt) {
-        const decoded = jwtDecode(v3jwt);
-        req.currentUser = {
-          handle: decoded.handle.toLowerCase(),
-          roles: decoded.roles,
-        };
-      }
-      req.signature = `${def.controller}#${def.method}`;
-      next();
-    });
+    if (!def.allowAnonymous) {
+      actions.push((req, res, next) => {
+        const v3jwt = _.get(req.cookies, constants.JWT_V3_NAME);
+        if (v3jwt) {
+          const decoded = jwtDecode(v3jwt);
+          req.currentUser = {
+            handle: decoded.handle.toLowerCase(),
+            roles: decoded.roles,
+          };
+        }
+        req.signature = `${def.controller}#${def.method}`;
+        next();
+      });
+    }
     if (def.tcLogin) {
       // middleware to handle TC login
       actions.push((req, res, next) => {
diff --git a/src/routes.js b/src/routes.js
index 6cadacf..af2946a 100644
--- a/src/routes.js
+++ b/src/routes.js
@@ -43,6 +43,7 @@ module.exports = {
       method: 'addUserToTeam',
       allowNormalUser: true,
       tcLogin: true,
+      allowAnonymous: true,
     },
   },
   '/github/normaluser/callback': {
@@ -50,6 +51,7 @@ module.exports = {
       controller: 'GithubController',
       method: 'addUserToTeamCallback',
       allowNormalUser: true,
+      allowAnonymous: true,
     },
   },
 
@@ -84,6 +86,7 @@ module.exports = {
       method: 'addUserToGroup',
       allowNormalUser: true,
       tcLogin: true,
+      allowAnonymous: true,
     },
   },
   '/gitlab/normaluser/callback': {
@@ -91,6 +94,7 @@ module.exports = {
       controller: 'GitlabController',
       method: 'addUserToGroupCallback',
       allowNormalUser: true,
+      allowAnonymous: true,
     },
   },