auth challenge is working cache-less now, need password check