step 4, auth logic