add UnsafeAllow3F flag so auth keeps on working after Apache security fixes