moved authentication logic into mix...still work to be done