authentication now happens at initialization, not later