support special cases where caller is the root auth (root auth must have a registry...