remove waf auth check