authentication without calling db every time works