enforce prefix for all auth keys