auth client request: IP/Signatue/Timestamp done, Policy check TBD