authentication with local and bearer