client auths via devise