all: disable auth for showing