auth. handler has to be called first