clarifying some authentication stuff