Tighten authenticate() for actions.