Auth-Type: request or control?