authenticates user but still pending