switch around auth strategies (fix #1346)