authentication working, just need to set req.authenticated