allows authentication