"Auth bypass" does not really describe what the feature actually does