only authenticate once per connection; closes #50