Refactor client auth to the ApiClient model
Refactor the controller side of token checks