forbid multiple bearer auths