deprecate legacy auth