nil check: assume db authentication unless otherwise specified