server-side user verification