def public(fun, scope=None, cookie=False):
    """
    Functions that allow any client access, including those that haven't logged
    in should be wrapped in this decorator.

    :param fun: A REST endpoint.
    :type fun: callable
    :param scope: The scope or list of scopes required for this token.
    :type scope: str or list of str or None
    :param cookie: if True, this rest endpoint allows the use of a cookie for
        authentication.  If this is specified on routes that can alter the
        system (those other than HEAD and GET), it can expose an application to
        Cross-Site Request Forgery (CSRF) attacks.
    :type cookie: bool
    """
    fun.accessLevel = 'public'
    fun.requiredScopes = scope
    if cookie:
        fun.cookieAuth = True
    return fun