start of authentication. Note: not finished