tmp removed auth req for users