run authenticate by default unless specifically set to false