client request authentication check