client side authorization