common-authorization: authorization service and client