some changes to test auth without ws-policy