* lowercase auth method type so that hardcoded and unauthed methods both use the same key * don't rely on top level data for capabilities serializer