sword auth working for builtin user at least #909