dont' need to allow self-signup