authenticates users (Iteration I2, Ch. 14)