auth:  allow non-confidential clients