provisional md5 auth