move auth to the client WIP