fix issues with source-url, vendor. bypass auth for now.