authentication for logged out users; note for error handling