overlay nssov + pass-through authentication