Should this take another authenticator, instead of a function?