turn on auth for blobs and principals as well minus POSTing blobs.  turn on real security config.