use the authenticate endpoint instead of running some random query