more clarification on authentication and authorization