treat 'auth required' as 'auth enabled'