Authenticate before authorize