have client side authentication working