ugly authentication