client authentication needed by default