started with very rudimentary device authentication