auth no longer gets hmac, client sends hmac