calling auth handler wrapped in MONGOOSE_NO_AUTH