`always-auth` is still important here. You don't want to send token auth information when you are using it.