strong auth with check on server