note that authenticators must be defined in app's namespace