authenticate against email