forward authentication, but take reply attributes from local db