Enable startup-time CPA auto-update with bucket-safe auth paths

1caafb1

verified

cjovs commited on May 3