make authentication optional