PLD: use require_auth instead of private