improved server-side authentication code