work on authentication challenge/response: not recognizing client response