step 2 auth achieved, untested