make user/pass authentication optional