fleshing out auth server-side