auth server code