improve web app authentication handling