auth-source out, though still supported