More authentication steps (wip)