switched to authenticate() in attempt_login