diff --git a/core/java/src/net/i2p/client/I2PSessionImpl.java b/core/java/src/net/i2p/client/I2PSessionImpl.java
index 35c205d50..ab2c48904 100644
--- a/core/java/src/net/i2p/client/I2PSessionImpl.java
+++ b/core/java/src/net/i2p/client/I2PSessionImpl.java
@@ -200,9 +200,8 @@ abstract class I2PSessionImpl implements I2PSession, I2CPMessageReader.I2CPMessa
             }
         }
 
-        // auto-add auth if required, not set in the options, and we are in the same JVM
-        // TODO bypass this on router side for internal connections
-        if (_context.isRouterContext() &&
+        // auto-add auth if required, not set in the options, and we are not in the same JVM
+        if ((!_context.isRouterContext()) &&
             Boolean.valueOf(_context.getProperty("i2cp.auth")).booleanValue() &&
             ((!options.containsKey("i2cp.username")) || (!options.containsKey("i2cp.password")))) {
             String configUser = _context.getProperty("i2cp.username");
diff --git a/router/java/src/net/i2p/router/client/ClientConnectionRunner.java b/router/java/src/net/i2p/router/client/ClientConnectionRunner.java
index 0b207da53..8bef2776d 100644
--- a/router/java/src/net/i2p/router/client/ClientConnectionRunner.java
+++ b/router/java/src/net/i2p/router/client/ClientConnectionRunner.java
@@ -109,7 +109,7 @@ class ClientConnectionRunner {
      */
     public void startRunning() {
         try {
-            _reader = new I2CPMessageReader(_socket.getInputStream(), new ClientMessageEventListener(_context, this));
+            _reader = new I2CPMessageReader(_socket.getInputStream(), new ClientMessageEventListener(_context, this, true));
             _writer = new ClientWriterRunner(_context, this);
             I2PThread t = new I2PThread(_writer);
             t.setName("I2CP Writer " + ++__id);
diff --git a/router/java/src/net/i2p/router/client/ClientMessageEventListener.java b/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
index edaefc599..d45df2cdb 100644
--- a/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
+++ b/router/java/src/net/i2p/router/client/ClientMessageEventListener.java
@@ -42,14 +42,19 @@ import net.i2p.util.RandomSource;
  *
  */
 class ClientMessageEventListener implements I2CPMessageReader.I2CPMessageEventListener {
-    private Log _log;
-    private RouterContext _context;
-    private ClientConnectionRunner _runner;
+    private final Log _log;
+    private final RouterContext _context;
+    private final ClientConnectionRunner _runner;
+    private final boolean  _enforceAuth;
     
-    public ClientMessageEventListener(RouterContext context, ClientConnectionRunner runner) {
+    /**
+     *  @param enforceAuth set false for in-JVM, true for socket access
+     */
+    public ClientMessageEventListener(RouterContext context, ClientConnectionRunner runner, boolean enforceAuth) {
         _context = context;
         _log = _context.logManager().getLog(ClientMessageEventListener.class);
         _runner = runner;
+        _enforceAuth = enforceAuth;
         _context.statManager().createRateStat("client.distributeTime", "How long it took to inject the client message into the router", "ClientMessages", new long[] { 60*1000, 10*60*1000, 60*60*1000 });
     }
     
@@ -153,10 +158,7 @@ class ClientMessageEventListener implements I2CPMessageReader.I2CPMessageEventLi
         }
 
         // Auth, since 0.8.2
-        // In-JVM accesses have access to the same context properties, so
-        // they will be set on the client side... therefore we don't need to pass in
-        // some indication of (socket instanceof InternalSocket)
-        if (Boolean.valueOf(_context.getProperty("i2cp.auth")).booleanValue()) {
+        if (_enforceAuth && Boolean.valueOf(_context.getProperty("i2cp.auth")).booleanValue()) {
             String configUser = _context.getProperty("i2cp.username");
             String configPW = _context.getProperty("i2cp.password");
             if (configUser != null && configPW != null) {
diff --git a/router/java/src/net/i2p/router/client/QueuedClientConnectionRunner.java b/router/java/src/net/i2p/router/client/QueuedClientConnectionRunner.java
index 4eec8e531..758e8221e 100644
--- a/router/java/src/net/i2p/router/client/QueuedClientConnectionRunner.java
+++ b/router/java/src/net/i2p/router/client/QueuedClientConnectionRunner.java
@@ -35,7 +35,7 @@ class QueuedClientConnectionRunner extends ClientConnectionRunner {
      */
     @Override
     public void startRunning() {
-        _reader = new QueuedI2CPMessageReader(this.queue, new ClientMessageEventListener(_context, this));
+        _reader = new QueuedI2CPMessageReader(this.queue, new ClientMessageEventListener(_context, this, false));
         _reader.startReading();
     }