authentication now relies on friend but friend isn't using real accounts to authenticate