allow client auth with scr