authentication works (patr 3 finish)