get capability banner outside of the authenticated API

it makes things more complicated if we have to authenticate to check the capabilities of a server