allow clients to validate server without providing their own credentials