i didn't want to have to complicate my code by handling the "challenge on arbitrary request trigger" so i just make it send the auth request if auth is required, before it even starts handling received messages.
according to NIP-42 spec this should be respected.