moved check for second authentication to its own method