broken implementation of authentication