removed the auth requirement for controll