strip auth check