bad implementation of authentication