don't require OK as auth response