auth is done by nginx