do not throw when there's no authentication