client can authenticate requests