This is a security fix, see PR #109.

Any users relying on the `auth` config option should upgrade to this version
immediately.