unknown users don't break sign-on