mention removal of client authentication