be non-destructive with auth changes