authentication is now the rule