minor rearrangement of authenticateUser()