use child, disable auth