After authentication, before cookies