auth: One const is enough...