AppServer auth logic