forced authentication across app