Separate client authorization from users