allow auth_extra override for CMS/LMS independently