partial support for 3leg auth (server side)