def isInsecurePath(req):
    """Check if the request is for an insecure path

       "Insecure" here means that unauthenticated/anonymous access should be
       allowed even if the system doesn't normally allow anonymous access."""
    if req.critic.settings.frontend.session_type == 'cookie':
        if req.path in ('login', 'validatelogin'):
            return True
    if req.critic.settings.users.allow_registration:
        if req.path in ('createuser', 'registeruser'):
            return True
    if req.path.startswith('static-resource/'):
        return True
    return False
