Plugins may define routes that do not require any login at all by defining "skip_before_action :require_login" in the controller. The access permissions tests should be skipped for these routes.