using authentication in production