fixed web vs device auth dance