just clarifying... unauthed requests containing directory kinds are processed, then after returning the results auth request is sent, which the client is free to ignore, and no subscription is created out of these requests, if the filter was modified it was because it wasn't authed so it just returns without starting a subscription on the filter