authenticating users for their subdomain