Treat authentication as one clue, never the whole verdict.
