Security fix: removed clientID/client object from the clientAction API.
All actions are now performed on the clientID that was used in creating
the clientAction object.