replaced "auth-only" with "authenticated-only" for clarity