[Security] allowed simple pre-auth to be optional if another auth mechanism already authenticated the user