You don't necessarily need to authenticate every request. For example, Amazon.com allows a user to be "semi-logged in", but forces you to authenticate yourself when doing something like making a purchase.