authentication half working