forward-authentication support