how to authenticate spa with asp.net core