client: send auth first thing

fixes ability to remove "read" permission from default permissions.