use cURL to authenticate