Add 'auth' parameter to only allow authentication for first use