fixed form authentication