forgot to handle non-auth case