call it authenticatePayload