tweaked legacy authentication