allow auth to be turned on/off (see config.dist.yaml)