[api] remember user access for client