allow authentication to be disabled