make payment require authentication
change to auth