moved authenticate to model