local auth works with valid and invalid creds