offload reverse auth to backend