Create sanction client in every request instead of storing it

The callback code could possibly fetch the wrong profile if the
authentication policy (and the sanction client) is shared between
different threads.  If there is only one sanction client and multiple
users trying to authenticate, we might end up using the someone else's
token to fetch a user's profile.

The solution is to not initialize the sanction client at configuration
time and to create a local client in the authentication code whenever we
need one.