put the authenticate call on the __lookup__ method

Just for consistency with what I did elsewhere. But, I'm not actually
convinced about which way is better.