swapped order of client auth filters, closes #610
propagated filter order change to other endpoints for consistency (shouldn't actually matter)