before auth-release WITHOUT crypto/common