get capability banner outside of the authenticated API
it makes things more complicated if we have to authenticate to check the capabilities of a server
it makes things more complicated if we have to authenticate to check the capabilities of a server