default for --auth should match the PBChangeSource defaults