only require auth once during challenge window