support async authentication with callback