use the AuthenticationService and RespondService in the authenticated policy