allow unauthenticated packages