I think this is already clear from the type signature.  `authenticate` can not do anything with the `a`...