client now access auth policy instance rather than class for api requests