making the authentication stateless