authenticate users for their own subdomain