added server side authentication check