More work on client side authentication