add client authorize api
check password when sending request