moving authentication_hash to here