Passive auth for web apps improved