Users are authenticated using a locally handled auth strategy