remove redundant auth from challenge3