make fallback endpoints also confirm authenticity
enable additional logging