User authentication and permission authorization