first working version of challenge response authentication. needs