Client-side authentication flow