what the hell do you mean they were doing auth client side? how is this possible with infinite budget?