or just force clients to give logins