Move auth flow to server-side