disabling auth by default