implement "auth if required"