implement actual server-side authentication