authentication works! ...even when encrypted