make server-side auth pure server-side