extrating common-auth from client-auth