mutual auth, step 2