authenticate result can be nil