implement fine grained per request authentication