Client side authentication leads to Auth Bypass