used in exactly the same way as hosts.equiv , but allows host-based authentication without permitting