These currently don't get flagged as not needing credentials and as we don't know what credentials they need we never get confirmation that the mechanism can be used.

Instead if it is not known to us we should just let it through.