add option to disable auth for zapps