fleshing out authentication