more work on authentication