authenticate by subdomain