browser authentication logic