removed option for auth via payload