last bit of authenticate