authentication nearly working