mock auth probably should work but password isn't being checked yet