write 2 steps of auth