add server side authentication