Basic server-side auth for shoresh