use same auth filename in step 2 and 3 to avoid confusion