remove authenticator non-greedily