first user authentication passes