simplified xAuth explanation