first half of two phase authentication