client side auth