allow client authorization at instantiation