authentication working - incomplete