authentication works.
list and show view