see #78, better auth block