hide challenge generation from auth.js