nil auth is permissive