add null checking at Authenticate