app has authentication