auth steps 2