honor timestamp in auth_hash