Why not just pass in `Authentication`?