don't auth by default