provisional one-time auth. Should probably move this code to LocalStrategy