You are right in that it would still need to authenticate.