removed auth from first rule