do not maintain user in session after authenticating