manual authentication