authentication moved to database