refactor/purify for client auth from databag