always-auth can be scoped per registry