starts authentication -- broken