split ssb-app-auth out of ssb-client