There was no need for BaseClient to expose it to every child, so I made it private.  The only BaseClient child that needed it was SessionsClient, so I made it private there.  The only reason SessionsClient needs it is because of the way the Heartbeat client is created--which is think could be moved to a better place anyway.

Bottom line: the only class that should need private access to authClient is BaseClient.