changes to authentication model and use of modelAttribute