client now sends authentication