client side authentication