adapt best practice from  angular-client-side-auth github repo