adding a no-auth mode to the primary manifest