3.16: don't require auth_user/password because we allow IP method