fix bogus unauthorized on bootstrap creation