allow auth files to be defined in locations