removed group-related auth reqs for now