use authenticateClient middleware instead of requiring the client registration token