allow username/password in auth object