it seems all the npm client needs is an AuthSession token from the server