Allow setup without auth, forbid once finished.