part way through user-authentication