reauth-specific hack should be conditional on reauth being enabled