handle limited auth in trashcan