+ no-op auth