basic authentication - client side