change authenticate to use the correct cancellationToken.