authentication client side