updated authentication model

no more stateless but stageful instead