auth requirement for settings requests;