refactor security page flow
add auth method to ClientSession
ClientSession everywhere refactor phase1