add a feature to disable auth