moving authentication into Javascript, second phase