False security: Dashy's client-side authentication