respect env variables for authentication request handlers