authentication roughly works