css path
spa client side auth info