client-side authentication