First verify if the client is authenticated. Then the state of the device authorization. If all is good, we take the Client from Storage.
reuse the client authentication code for device authorization and introspection.