use correct auth, when server, always mock when local.