don't reject unauthorized, for now