optionally disable client auth