changed client auth default to allow