temporarily use carrot/superstatic to allow auth