correctly check for authentication