client: setup auth, shows ui. server: fixes
finish server-side auth