handle challenge response