Allow passive auth for web apps