redirection seems to work with friend/authenticated, as expected