starting to add client side auth, tests