docs
if no auth, don't check