Authorize with bearer, identify user correctly.