authenticate now accepts the list of sources to authenticate against if none is pass all will be used