allow unauthenticated packages too!