code: func (cap *CFSSL) validateAuth() error {
  	// The client is using some form of authentication, and the best way
  	// to figure out that the auth is invalid is when it's used. Therefore,
  	// we'll delay checking the credentials until that time.
  	if cap.provider != nil {
  		return nil
  	}
  
  	hosts := cap.remote.Hosts()
  	for i := range hosts {
  		ips, err := net.LookupIP(hosts[i])
  		if err != nil {
  			return err
  		}
  
  		for _, ip := range ips {
  			if !ipIsLocal(ip) {
  				return ErrNoAuth
  			}
  		}
  	}
  
  	return nil
  }
docs: // The only time a client should be doing unauthenticated requests is
  // when a local CFSSL is being used.