remove auth check against User-Password, add autz warning