moved authentication to plugin