auth for client side