authenticate using headless browser, not yet tested